Out-of-band Authentication via QR Code for Offline Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing out-of-band authentication techniques are vulnerable to attacks that compromise devices supplying supplemental credentials and fail when the mobile device lacks network access, leading to potential unauthorized access and authentication failures.
Innovation Solution
The implementation of a process where a high-entropy, single-use value is conveyed from an authentication server to a network-connected device, which is then transformed by a mobile device (even without network access) to demonstrate proof of possession of a cryptographic key, using methods like QR codes or secure channels within trusted execution environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional out-of-band authentication is implemented using network-connected mobile devices, then authentication security is improved, but the system fails when the mobile device lacks network access
Solution Approach 1:
The patent introduces a QR code as an intermediary carrier that transfers authentication data from the network-connected client device to the mobile device. The QR code encodes encrypted authentication challenges and responses, allowing the mobile device to participate in authentication without requiring network connectivity. This mediator enables data transfer across network boundaries, resolving the contradiction between requiring network access for security and needing offline capability.
Solution Approach 2:
The system performs preliminary actions by pre-generating and encoding authentication challenges and cryptographic key pairs into QR codes before the mobile device needs to authenticate. The client device prepares authentication data in advance, encrypts it with the user's public key, and embeds it in the QR code. This preliminary preparation allows the mobile device to complete authentication offline by simply scanning the code and using its private key, eliminating the need for real-time network access.
2Reliability
If supplemental credentials are transmitted through network-connected devices, then authentication factors are enhanced, but vulnerability to credential capture attacks increases
Solution Approach 1:
The patent replaces the traditional mechanical/ electronic transmission of credentials through network channels with an optical transmission system using QR codes. Authentication data is converted into visual patterns that can be captured by the mobile device's camera. This substitution eliminates the need for vulnerable network transmission of sensitive credential data, as the information is transferred optically and then processed locally using cryptographic keys that never leave the mobile device.
Solution Approach 2:
The system creates a visual copy of the authentication data in the form of a QR code that can be scanned and processed. Instead of transmitting sensitive credential data through vulnerable network channels, the system encodes authentication challenges and encrypted responses as visual patterns. The mobile device captures this visual copy and processes it locally using stored cryptographic keys, ensuring that the actual credentials remain protected while still enabling authentication.
3Reliability
If cryptographic key pairs are used for secure authentication, then security is enhanced, but device complexity increases
Solution Approach 1:
The patent extracts the complex cryptographic key management operations from the mobile device and concentrates them in the client device and authentication server. The mobile device only needs to store its private key securely and perform simple decryption operations. The client device generates the cryptographic key pairs and manages the public keys, while the server handles the authentication logic. This extraction reduces the computational and management burden on the mobile device, making the system more practical despite the cryptographic complexity.
Data Source
AI summary
Provided is a process that affords out-of-band authentication for confirmation of physical access or when a device utilized for out-of-band authentication lacks connectivity to a network. An asymmetric cryptographic key-pair is established, a first device obtaining a key operable to decrypt data. A remote server obtaining a key operable to encrypt data and associating that key with an identifier of an identity or account associated with a user. An access attempt from the second device is received in association with the identifier of the identity associated with the user. A notification including data encrypted by the encryption key is generated by the remote server and transmitted to the second device. The first device obtains the notification data from the second device and decrypts the data to determine a notification response which is returned to the remote server for verification to permit or deny the access attempt of the second device.